feat(manager/flux): support chartRef in HelmRelease resources

lib/modules/manager/flux/__fixtures__/helmChart.yaml

@@ -0,0 +1,14 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmChart
+metadata:
+  name: sealed-secrets
+  namespace: kube-system
+spec:
+  interval: 10m
+  chart: sealed-secrets
+  sourceRef:
+    kind: HelmRepository
+    name: sealed-secrets
+  version: "2.0.2"
+  valuesFiles:
+    - values-prod.yaml

lib/modules/manager/flux/__fixtures__/helmChartRefRelease.yaml

@@ -0,0 +1,13 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: sealed-secrets
+  namespace: kube-system
+spec:
+  interval: 10m
+  chartRef:
+    kind: HelmChart
+    name: sealed-secrets
+    namespace: kube-system
+  values:
+    replicaCount: 2

lib/modules/manager/flux/common.ts

@@ -1,4 +1,6 @@
 import { regEx } from '../../../util/regex';
+import type { HelmRepository } from './schema';
+import type { FluxManifest } from './types';
 
 export const systemManifestFileNameRegex = '(?:^|/)gotk-components\\.ya?ml$';
 
@@ -8,3 +10,19 @@ export const systemManifestHeaderRegex =
 export function isSystemManifest(file: string): boolean {
   return regEx(systemManifestFileNameRegex).test(file);
 }
+
+export function collectHelmRepos(manifests: FluxManifest[]): HelmRepository[] {
+  const helmRepositories: HelmRepository[] = [];
+
+  for (const manifest of manifests) {
+    if (manifest.kind === 'resource') {
+      for (const resource of manifest.resources) {
+        if (resource.kind === 'HelmRepository') {
+          helmRepositories.push(resource);
+        }
+      }
+    }
+  }
+
+  return helmRepositories;
+}

lib/modules/manager/flux/extract.spec.ts

@@ -14,6 +14,9 @@ import { extractAllPackageFiles, extractPackageFile } from '.';
 
 const config: ExtractConfig = {};
 const adminConfig: RepoGlobalConfig = { localDir: '' };
+const fixtureHelmSource = Fixtures.get('helmSource.yaml');
+const fixtureHelmChart = Fixtures.get('helmChart.yaml');
+const fixtureHelmChartRefRelease = Fixtures.get('helmChartRefRelease.yaml');
 
 describe('modules/manager/flux/extract', () => {
   beforeEach(() => {
@@ -150,6 +153,22 @@ describe('modules/manager/flux/extract', () => {
       });
     });
 
+    it('ignores HelmRelease resources without any chart reference', () => {
+      const result = extractPackageFile(
+        codeBlock`
+          apiVersion: helm.toolkit.fluxcd.io/v2beta1
+          kind: HelmRelease
+          metadata:
+            name: sealed-secrets
+            namespace: kube-system
+          spec:
+            interval: 10m
+        `,
+        'test.yaml',
+      );
+      expect(result).toBeNull();
+    });
+
     it('ignores HelmRelease resources without a chart name', () => {
       const result = extractPackageFile(
         codeBlock`
@@ -228,7 +247,7 @@ describe('modules/manager/flux/extract', () => {
     it('does not match HelmRelease resources without a sourceRef', () => {
       const result = extractPackageFile(
         codeBlock`
-          ${Fixtures.get('helmSource.yaml')}
+          ${fixtureHelmSource}
           ---
           apiVersion: helm.toolkit.fluxcd.io/v2beta1
           kind: HelmRelease
@@ -258,7 +277,7 @@ describe('modules/manager/flux/extract', () => {
     it('does not match HelmRelease resources without a namespace', () => {
       const result = extractPackageFile(
         codeBlock`
-          ${Fixtures.get('helmSource.yaml')}
+          ${fixtureHelmSource}
           ---
           apiVersion: helm.toolkit.fluxcd.io/v2beta1
           kind: HelmRelease
@@ -325,6 +344,181 @@ describe('modules/manager/flux/extract', () => {
       });
     });
 
+    it('ignores HelmRelease resources using an invalid chartRef', () => {
+      const result = extractPackageFile(
+        fixtureHelmChartRefRelease,
+        'test.yaml',
+      );
+      expect(result).toBeNull();
+    });
+
+    it('ignores HelmRelease resources using a chartRef targetting a HelmChart', () => {
+      const result = extractPackageFile(
+        codeBlock`
+          ${fixtureHelmChartRefRelease}
+          ---
+          ${fixtureHelmChart}
+          ---
+          ${fixtureHelmSource}
+        `,
+        'test.yaml',
+      );
+      // HelmRelease is ignored, only HelmChart itself is processed (-> no duplicates expected)
+      expect(result).toEqual({
+        deps: [
+          {
+            currentValue: '2.0.2',
+            datasource: HelmDatasource.id,
+            depName: 'sealed-secrets',
+            registryUrls: ['https://bitnami-labs.github.io/sealed-secrets'],
+          },
+        ],
+      });
+    });
+
+    it('ignores HelmRelease resources using a chartRef targetting an OCIRepository', () => {
+      const result = extractPackageFile(
+        codeBlock`
+          ${Fixtures.get('ociSource.yaml')}
+          ---
+          apiVersion: helm.toolkit.fluxcd.io/v2
+          kind: HelmRelease
+          metadata:
+            name: kyverno-controller
+            namespace: kube-system
+          spec:
+            chartRef:
+              kind: OCIRepository
+              name: kyverno-controller
+              namespace: kube-system
+        `,
+        'test.yaml',
+      );
+      // HelmRelease is ignored, only OCIRepository itself is processed (-> no duplicates expected)
+      expect(result).toEqual({
+        deps: [
+          {
+            autoReplaceStringTemplate:
+              '{{#if newValue}}{{newValue}}{{/if}}{{#if newDigest}}@{{newDigest}}{{/if}}',
+            currentDigest: undefined,
+            currentValue: 'v1.8.2',
+            depName: 'ghcr.io/kyverno/manifests/kyverno',
+            datasource: DockerDatasource.id,
+            replaceString: 'v1.8.2',
+          },
+        ],
+      });
+    });
+
+    it('extracts HelmChart version', () => {
+      const result = extractPackageFile(
+        codeBlock`
+          ${fixtureHelmSource}
+          ---
+          ${fixtureHelmChart}
+        `,
+        'test.yaml',
+      );
+      expect(result).toEqual({
+        deps: [
+          {
+            currentValue: '2.0.2',
+            datasource: HelmDatasource.id,
+            depName: 'sealed-secrets',
+            registryUrls: ['https://bitnami-labs.github.io/sealed-secrets'],
+          },
+        ],
+      });
+    });
+
+    it('does not match HelmChart resources without a namespace', () => {
+      const result = extractPackageFile(
+        codeBlock`
+          ${fixtureHelmSource}
+          ---
+          apiVersion: source.toolkit.fluxcd.io/v1
+          kind: HelmChart
+          metadata:
+            name: sealed-secrets
+          spec:
+            interval: 10m
+            chart: sealed-secrets
+            sourceRef:
+              kind: HelmRepository
+              name: sealed-secrets
+            version: "2.0.2"
+        `,
+        'test.yaml',
+      );
+      expect(result).toEqual({
+        deps: [
+          {
+            currentValue: '2.0.2',
+            datasource: HelmDatasource.id,
+            depName: 'sealed-secrets',
+            skipReason: 'unknown-registry',
+          },
+        ],
+      });
+    });
+
+    it('ignores HelmChart resources using git sources', () => {
+      const result = extractPackageFile(
+        codeBlock`
+          apiVersion: source.toolkit.fluxcd.io/v1
+          kind: HelmChart
+          metadata:
+            name: sealed-secrets
+            namespace: kube-system
+          spec:
+            interval: 10m
+            chart: ./helm/sealed-secrets
+            sourceRef:
+              kind: GitRepository
+              name: sealed-secrets
+        `,
+        'test.yaml',
+      );
+      expect(result).toBeNull();
+    });
+
+    it('ignores HelmChart resources using bucket sources', () => {
+      const result = extractPackageFile(
+        codeBlock`
+          apiVersion: source.toolkit.fluxcd.io/v1
+          kind: Bucket
+          metadata:
+            name: sealed-secrets
+            namespace: kube-system
+          spec:
+            interval: 5m0s
+            endpoint: sealed-secrets.example.com
+            bucketName: example
+          ---
+          apiVersion: source.toolkit.fluxcd.io/v1
+          kind: HelmChart
+          metadata:
+            name: sealed-secrets
+            namespace: kube-system
+          spec:
+            interval: 10m
+            chart: ./helm/sealed-secrets
+            sourceRef:
+              kind: Bucket
+              name: sealed-secrets
+        `,
+        'test.yaml',
+      );
+      expect(result).toEqual({
+        deps: [
+          {
+            depName: './helm/sealed-secrets',
+            skipReason: 'unsupported-datasource',
+          },
+        ],
+      });
+    });
+
     it('ignores GitRepository without a tag nor a commit', () => {
       const result = extractPackageFile(
         codeBlock`
@@ -875,5 +1069,26 @@ describe('modules/manager/flux/extract', () => {
       ]);
       expect(result).toBeNull();
     });
+
+    it('should pick correct package file when using HelmRepository with chartRef', async () => {
+      const result = await extractAllPackageFiles(config, [
+        'lib/modules/manager/flux/__fixtures__/helmChartRefRelease.yaml',
+        'lib/modules/manager/flux/__fixtures__/helmChart.yaml',
+        'lib/modules/manager/flux/__fixtures__/helmSource.yaml',
+      ]);
+      expect(result).toEqual([
+        {
+          deps: [
+            {
+              currentValue: '2.0.2',
+              datasource: HelmDatasource.id,
+              depName: 'sealed-secrets',
+              registryUrls: ['https://bitnami-labs.github.io/sealed-secrets'],
+            },
+          ],
+          packageFile: 'lib/modules/manager/flux/__fixtures__/helmChart.yaml',
+        },
+      ]);
+    });
   });
 });